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PREFACE 

This  document  was  prepared  by  the  Range  Safety  Group  (RSG),  Range  Commanders 
Council  (RCC)  under  Task  RS-39.  The  Group  investigated  options  other  than  “destruct”  for 
unmanned  aerial  vehicles  (UAVs)  flying  in  the  National  Airspace  (NAS)  over  populated  areas 
and  outside  the  range  of  local  line-of-sight  (LOS)  flight  termination  system  (FTS)  transmitters. 

The  objective  of  this  document  was  to  develop  an  RCC  standard  for  over-the-horizon 
(OTH)  safe  recovery  of  UAVs.  The  task  considered  requirements  for  global  monitoring  of  UAV 
critical  safety  information  and  implementation  of  hazard  control  options  such  as  reset  flight 
control  computer,  uplink  new  route,  change  altitude,  and  override  controls  for  UAV  safe- 
recovery  operations. 

The  RCC  gives  special  acknowledgement  for  production  of  this  document  to  members  of 
the  RSG.  Please  direct  any  questions  to  the  group’s  point  of  contact  or  to  the  RCC  Secretariat  as 
shown  below. 


Mr.  Robert  Palmer 

Member  Range  Safety  Group  (RSG) 

Air  Force  Flight  Test  Center 

Mr.  Michael  Young 

Member  Range  Safety  Group  (RSG) 

NASA  Dryden  Flight  Research  Center 


Secretariat,  Range  Commanders  Council 
ATTN:  TEDT-WS-RCC  (RF  Systems  Committee) 
1510  Headquarters  Avenue 

White  Sands  Missile  Range,  New  Mexico  88002-5 110 
Telephone:  (575)  678-1107,  DSN  258-1 107 

E-mail  usanny.wsmr.atec.list.rcc@mail.mil 
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ACRONYMS  AND  ABBREVIATIONS 


3-DES 

Triple  Data  Encryption  Standard 

ACK-NAK 

acquisition/no  acquisition 

AFFTC 

Air  Force  Flight  Test  Center 

ARINC 

Aeronautical  Radio,  Inc 

CRC 

Cyclic  Redundancy  Checklists 

FAA 

Federal  Aviation  Administration 

FTS 

flight  termination  system 

GEO 

geo  stationary  earth  orbit 

LBT 

L-Band  Transceiver 

LEO 

low  Earth  orbit 

MEO 

medium  Earth  orbit 

MTBF 

mean  time  between  failure 

UAV 

unmanned  aerial  vehicle 

OTH 

over-the-horizon 

PSTN 

public  switched  telephone  network 

RAFS 

Robust  Affordable  Flight  Safety 

RSO 

Range  Safety  Officer 
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CHAPTER  1 

RS-39  TASK  REPORT 


1.1  Introduction 

Test  ranges  currently  use  simple,  line-of-sight  transmission  systems  to  control  errant 
Unmanned  Aerial  Vehicles  (UAVs).  Typically,  this  means  placing  the  hazardous  vehicles  in  a 
zero-lift,  zero-thrust  condition  through  some  sort  of  destructive  mechanism.  These  transmission 
systems  or  “Flight  Termination  Systems  (FTSs)”  work  well  for  UAVs  that  remain  within  a 
certain  distance  of  the  FTS  (or  Command)  transmitter,  but  fail  to  meet  long-range,  high-altitude 
UAV  requirements.  Additionally,  these  FTSs  increase  operational  risk  as  they  are  susceptible  to 
signal  interference  and  the  possibility  of  unauthorized  users.  The  RS-39  task  was  established  to 
investigate  alternatives  to  traditional  FTSs  for  use  on  UAVs  flying  over  populated  areas,  outside 
range  airspace,  beyond  line-of-sight,  or  that  have  demonstrated  reliability  making  FTS 
undesirable  or  unnecessary  but  where  additional  controls  are  still  warranted  to  mitigate  risk. 

1.2  Alternatives  Considered  for  FTS 

A  wide  variety  of  alternatives  were  examined  during  the  RS-39  task.  Key  requirements 
consisted  of  global  coverage,  over-the-horizon  (OTH)  operation,  data  throughput  rates,  system 
complexity,  and  availability.  Based  on  these  requirements,  alternatives  were  separated  into  two 
categories.  The  first  category  included  terrestrial  or  land-based  systems,  and  the  second 
consisted  of  satellite  based  systems. 

1.2.1  Terrestrial  Systems.  Terrestrial  systems  offer  a  number  of  benefits,  but  fail  to  support 
many  critical  requirements.  For  instance,  the  Federal  Aviation  Administration’s  (FAA’s) 
Aeronautical  Radio,  Inc.  (ARINC)  communication  network  provides  OTH  coverage  and  good 
data  throughput,  but  system  complexity  makes  it  impossible  to  interface  with.  Out  of  twenty- 
four  terrestrial  alternatives,  only  two  showed  promise  and  after  further  study  even  those  fell  short 
of  providing  the  needed  capabilities.  As  a  result,  the  RS-39  task  focused  on  satellite  systems. 

1.2.2  Satellite  Systems.  Satellite  systems  appear  to  be  the  obvious  choice  for  long-range  OTH 
applications  since  most  provide  near-global  coverage.  In  addition,  their  digital  infrastructures 
make  it  easy  and  cost-effective  for  ranges  to  connect  them  to  their  existing  networks.  Satellite 
systems  are  classified  into  three  primary  orbit  types:  Low  Earth  Orbit  (LEO),  Medium  Earth 
Orbit  (MEO),  and  Geo-stationary  (synchronous)  Earth  Orbit  (GEO).  The  RS-39  task  found  that 
MEO  and  GEO  satellites  incurred  propagation  delays  which  were  unacceptably  large  for  FTS 
use.  As  such,  they  were  eliminated  and  researchers  concentrated  on  LEO  satellites. 

a.  LEO  Satellites.  LEO  satellites  are  a  good  idea  for  more  than  just  technical  reasons. 
Industry  has  placed  large  financial  investments  into  LEO  satellites  to  upgrade  their 
global  communication  networks.  Ranges  can  leverage  these  investments  to  develop 
advanced  FTS  applications  without  worrying  about  lifecycle  and  mission  assurance 
issues.  The  following  table  lists  the  possible  LEO  alternatives  and  whether  or  not 
they  support  the  driving  requirements. 
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TABLE  1-1.  SATELLITE  SELECTION  MATRIX 


Status 


Instantaneous 

Coverage 


Latency 


Throughput 


Terminal  Complexity 

Antenna 

Complexity 

Simple  VHF/UHF 

omni  antenna 

Simple  VHF/UHF 

omni  antenna 

© 

Simple  VHF/UHF 

omni  antenna 

c 

Simple  VHF/UHF 

omni  antenna 

© 

Simple  VHF/UHF 

omni  antenna 

iUj 

Simple  VHF/UHF 

omni  antenna 

© 

Simple  VHF/UHF 

omni  antenna 

Simple  VHF/UHF 

omni  antenna 

LEO  messaging 


Orbcomm 


VITAsat 


LEO  ONE 


E-Sat 


ARGOS 


Apnze  Satellite 


SENS 


FAISAT 


Existing 


Existing 


Planned 


Planned 


Existing 


Planned 


Planned 


Planned 


LEO  voice  and  data 

Globalstar 

Existing 

RT 

9.6  kbps 

Complex  L  Band 

omni  antenna 

Q 

Iridium 

Existing 

66  satellites 

RT 

2.4  to  10  kbps 

Complex  L  Band 

omni  antenna 

Teledesic 

Planned 

^28^atellite^l 

RT 

2  to  64  mbps 

[•I 

Courier 

|  Planned  1 

72  satellites 

RT 

Unknown 

Unknown 

Unknown 

©1 

MEO  voice  and  data 


Ellioso 

RT 

28.8  kbps 

Complex  L.S  Band 

omni  antenna 

© 

GPS  block  modifications 

global 

RT 

?? 

?? 

?? 

* 

ECO-8 

Existing 

RT 

9.6  kbps 

Complex  L  Band 

omni  antenna 

New  ICO 

RT 

144  kbps 

Unknown 

Unknown 

Best,  satisfies  requirement,  most  confidence,  easiest 
Cautionary,  may  satisfy  requirement,  some  confidence,  some  diffi 
Worst,  does  not  satisfy  requirement,  least  confidence,  most  diff 


culty 

icult 


RT  Real  Time 

S&F  Store  and  Forward 


b.  IRIDIUM  Satellite  System.  A  quick  look  at  Table  1-1  reveals  that  many  LEO 
satellites  meet  most  requirements,  but  only  IRIDIUM  satisfies  all  of  them.  The 
IRIDIUM  system  is  an  existing  network  of  66  satellites  designed  to  deliver  reliable 
real-time  voice,  data,  paging,  and  facsimile  communications  all  over  the  planet.  Full 
duplex  data  rates  in  excess  of  2.4  kbps  are  supported.  IRIDIUM  uses  a  ‘switched’ 
architecture,  ensuring  true  global  coverage.  Access  is  via  a  cell-phone  like  unit  with 
omni-directional  antenna  or  a  data  modem  unit.  Based  on  these  findings,  IRIDIUM 
was  selected  as  the  most  feasible  alternative. 

1.3  Prototype  FTS  Built:  Robust  Affordable  Flight  Safety  (RAFS)  System 

Since  IRIDIUM  was  deemed  most  suitable,  a  prototype  FTS  was  developed  to  validate 
the  concept.  The  prototype  was  called  the  RAFS.  Developed  by  Reliable  System  Services 
Corporation  under  contract  to  the  Air  Force  Flight  Test  Center  (AFFTC),  the  RAFS  design 
leveraged  expertise  within  the  Range  Commanders  Council  (RCC)  Range  Safety  Group  to 
ensure  key  FTS  concerns  were  addressed  and  RCC  319  (Flight  Termination  Systems 
Commonality  Standard)  requirements  were  met.  The  result  was  a  system  that  provided  many 
enhanced  capabilities  while  adhering  to  traditional  FTS  requirements. 

In  addition  to  an  OTH  capability,  a  key  enhancement  is  the  ability  to  receive  vehicle  and 
FTS  health  and  status  from  UAVs.  This  enhancement  is  possible  because  the  IRIDIUM  system 
transmits  data  in  both  directions.  The  result  is  improved  situational  awareness  independent  of 
conventional  telemetry  systems.  Figure  FT  illustrates  the  RAFS  system  concept. 
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IRIDIUM 


Figure  1-1.  RAFS  Concept. 

The  RAFS  makes  it  possible  to  communicate  with  UAVs  anywhere  in  the  world.  As 
Figure  1-1  shows,  the  Range  Safety  Officer  (RSO)  can  monitor  health  and  status  parameters  like 
engine  performance  and  control  system  data.  The  RSO  can  also  issue  special  commands  for 
improved  safety  when  flying  outside  restricted  airspace.  For  example,  an  RSO  can  tell  an  errant 
vehicle  to  return  to  base  or  fly  a  specific  pattern  centered  on  predetennined  coordinates  until  a 
solution  to  the  problem  is  determined.  This  option  is  extremely  attractive  to  projects  that  have 
established  high  vehicle  reliability  through  actual  flight  test  as  it  could  eliminate  the  need  for  a 
traditional  FTS. 

The  RAFS  development  was  accomplished  in  two  years  and  culminated  in  a  successful 
flight  demonstration.  During  the  demonstration,  engineers  sent  FTS  and  special  vehicle 
commands  from  the  RAFS  ground  station  located  at  Edwards  AFB,  California,  to  a  UAV  flying 
over  Patuxent  River  Naval  Station,  Maryland.  The  engineers  were  also  able  to  monitor  the 
vehicle  and  RAFS  health  and  status  parameters. 

1.4  Prototype  issues 

Although  the  test  and  overall  development  effort  was  deemed  successful,  a  few  issues 
were  uncovered  that  affect  IRIDIUM’s  ability  to  support  FTS  applications.  The  two  most 
important  were  link  availability  and  data  latency.  The  link  availability  was  calculated  at  0.9661 
percent,  which  is  well  below  the  RCC  319  requirement  of  0.999  percent.  Latency  issues  were 
caused  by  data  buffering  and  delayed  FTS  commands  for  up  to  four  seconds. 
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a.  Link  Availability,  Communications  links  robustness  is  typically  measured  in  terms  of 
link  availability.  Availability  assumes  that  a  repair,  with  some  Mean  Time  Between 
Failure  (MTBF)  Analysis,  can  be  performed.  Detailed  availability  information  is  not 
available  from  IRIDIUM  or  Boeing  (operators  of  the  network).  The  RAFS  Risk 
Reduction  testing  estimated  availability  by  measuring  performance  (downtime  vs. 
mission  time)  over  an  extended  time  interval.  The  measured  results  showed 
performance  for  all  aspects  of  the  communications  infrastructure.  Results  of  the 
initial  testing,  based  on  more  than  103  hours  of  test  time  randomly  distributed  over 
approximately  five  months,  are  shown  in  Table  1-2.  Analysis  of  the  collected  data 
and  discussions  with  Boeing,  provided  insight  into  the  IRIDIUM  disconnect 
mechanisms.  Table  1-2  shows  two  availability  numbers:  source  disconnect  time  and 
destination  disconnect  time.  The  difference  is  due  to  the  observed  disconnection 
process.  First,  the  IRIDIUM  L-Band  Transceiver  (LBT)  in  the  RAFS  airborne  system 
(the  destination)  stops  accepting  data,  and  is  effectively  disconnected.  Some  time 
later  the  IRIDIUM  Gateway  receives  an  indication  of  a  disconnect  and  passes  this 
information  to  the  RAFS  ground  station  (the  source).  The  net  result  of  this  process  is 
that  disconnect  times  based  on  the  destination  statistics  are  greater  than  the  disconnect 
times  based  on  the  source  statistics. 

Note  that  each  item  in  Table  1-2  was  generated  by  processing  each  event  on 
an  event-by- event  basis.  Consequently,  a  small  round-off  error  exists  within  the  table 
(when  converting  hours,  minutes,  and  seconds)  which  does  not  affect  the  computed 
results. 


TABLE  1-2.  LINK  AVAILABILITY  ANALYSIS  FOR  PUBLICE  SWITCHED 

TELEPHONE  NETWORK  (PSTN)  CONNECTION  METHOD 

Sum  Total  Time  (Seconds) 

373004.00 

Sum  Total  Time  (Minutes) 

6216.73 

Sum  Total  Time  (Hours) 

103.61 

Sum  Source  Disconnect  Time  (Seconds) 

4151.00 

Sum  Source  Disconnect  Time  (Minutes) 

69.18 

Sum  Source  Disconnect  Time  (Hours) 

1.15 

Sum  Destination  Disconnect  Time  (Seconds) 

12631.26 

Sum  Destination  Disconnect  Time  (Minutes): 

210.52 

Sum  Destination  Disconnect  Time  (Hours): 

3.51 

Link  Availability  (source  disconnect  time): 

0.9889 

Link  Availability  (destination  disconnect  time): 

0.9661 
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The  previously  described  disconnection  mechanism  suggests  the  use  of  a 
protocol  to  reduce  disconnect  times  by  forcing  the  destination  to  disconnect  after  a  set 
timeout.  Given  that  a  disconnect  occurs  because  of  an  inter-satellite  link  hand-off 
condition  (which  allows  rapid  re-connection),  application  unique  protocol  software 
could  reduce  the  disconnect  time.  This  software,  which  uses  periodic  “heartbeat” 
messages  to  monitor  the  infrastructure  health  (availability),  was  recently  tested. 

Based  on  a  single  24  hour  test  period,  a  significant  availability  improvement  was 
observed.  The  algorithm  was  added  to  the  RAFS  Basic  Ground  Station’s  software.  A 
patent  has  been  submitted  for  the  reconnection  algorithm. 

The  team  observed  another  disconnection  phenomenon.  These  disconnects, 
although  infrequent,  lasted  longer  than  4  minutes,  are  probably  (according  to  Boeing) 
due  to  failed  spot  beams  on  the  satellite.  During  the  previously  described  24  hour 
test,  one  of  these  types  of  disconnects  occurred.  These  disconnects  may  be  mitigated 
by  mission  planning;  i.e.,  predicting  outages  based  on  spacecraft  health.  This  issue 
should  be  a  future  topic  of  discussion  with  IRIDIUM/Boeing.  If  the  disconnects  can 
be  mitigated,  the  end-to-end  availability  could  be  further  improved. 

According  to  Boeing,  the  disconnections  that  allow  rapid  re-connection  are 
probably  occurring  during  the  inter-satellite  hand-off  process  (as  one  satellite  leaves 
the  field  of  view  and  transfers  the  user  to  another  satellite).  Boeing  personnel  feel 
that  this  is  a  fault  condition  due  to  software  within  the  LBT.  The  next  version  of  LBT 
software  is  expected  to  reduce  the  number  of  disconnects  and  will  improve 
communications  infrastructure  availability.  Also,  an  analog  PSTN  line  is  used  to 
connect  the  RAFS  Ground  Station  to  the  IRIDIUM  Gateway.  According  to  Boeing, 
the  use  of  a  network  connection  instead  of  a  PSTN  will  significantly  reduce  the 
connection  time. 

b.  Latency.  Latency  is  the  difference  between  the  time  a  data  packet  is  transmitted  by 
the  source  unit  (RAFS  Ground  Station)  and  when  it  is  received  by  the  destination  unit 
(RAFS  Airborne  Unit).  Latency  consists  of  propagation  time  over  the  telephone 
network  from  the  RAFS  Ground  Station  to  the  IRIDIUM  Gateway,  IRIDIUM 
Gateway  processing  delay,  IRIDIUM  Gateway  to  satellite  propagation  delay,  satellite 
processing  delay,  satellite  to  LBT  delay,  LBT  processing  time,  and  RAFS  airborne 
system  processing  time. 

A  spreadsheet  was  built  to  analyze  latency.  The  spreadsheet  accepted  data 
(manual  entry)  calculated  for  each  area  that  added  time  to  the  propagation  delay  and 
generated  an  overall  delay.  The  spreadsheet  contained  an  “include”  flag,  which 
indicated  whether  a  destination  file  would  be  included  in  the  final  computation.  This 
was  needed  because  some  test  runs  used  to  determine  link  margin  were  conducted 
with  high  in-line  attenuation  (as  much  as  12  dB).  The  added  attenuation  significantly 
increased  latency  (by  intent,  to  determine  link  margin).  An  analysis  was  performed 
for  both  conditions,  since  it  provides  insight  into  degraded  link  impact  on  overall 
perfonnance. 
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A  weighted  average  for  the  various  percentile  latencies  was  calculated,  as  shown 
below: 


Average  %  latency  = 


#  of  files 

i 

N=1 


#  of  samples  in  file  N 
Total  samples  in  all  files 


x  (%  latency  for  file  N) 


An  analysis  was  performed  for  all  RAFS  configurations  and  found  that 
buffering  in  the  IRIDIUM  Gateway  and  within  the  RAFS  airborne  unit  caused 
intennittent  delay  patterns  that  reached  4  seconds  at  peak  network  operating  times. 
Delay  times  versus  probability  are  provided  in  Figure  1-2.  This  figure  simply 
expresses  the  probability  that  a  data  packet  will  be  delayed  for  a  certain  amount  of 
time.  For  instance,  there  is  a  96.7  percent  chance  that  an  FTS  command  (i.e.,  a  data 
packet)  will  be  delayed  4  seconds. 


Average  CDF 


Milliseconds 


Figure  1-2.  Delay  versus  Probability 

The  latency  problem  is  caused  by  extensive  data  buffering  due  to  the 
IRIDIUM  Acquisition-No  Acquisition  (ACK-NAK)  process,  needed  to  guarantee 
data  delivery  (per  Boeing,  and  verified  by  collected  data).  Voice  calls  (the  primary 
purpose  for  IRIDIUM),  which  do  not  provide  guaranteed  delivery,  have  short  drop¬ 
outs  vs.  high  latency  (example:  recent  F-16  test).  According  to  IRIDIUM,  it  is 
possible  to  disable  the  guaranteed  data  delivery  process  for  data  calls.  Then,  only  a 
“basic”  latency  (-600  ms)  will  occur  (no  higher  latencies).  This  basic  latency  comes, 
however,  at  the 
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expense  of  guaranteed  data  delivery  and  potential  data  errors.  This  may  be  acceptable 
because: 

a.  RAFS  short  command  messages  are  protected  with  authentication  &  Triple  Data 
Encryption  Standard  (3-DES)  encryption,  as  well  as  a  Cyclic  Redundancy  Check 
(CRC). 

b.  All  valid  commands  from  the  RAFS  ground  station  are  positively  acknowledged  by 
the  RAFS  airborne  system. 

c.  Multiple  sequential  commands  can  be  sent  until  this  acknowledgement  is  received  to 
alleviate  the  potential  missed  messages. 
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CHAPTER  2 

SUMMARY 

The  RS-39  task  looked  at  a  number  of  FTS  alternatives  for  UAVs  flying  over  populated 
areas,  outside  restricted  airspace,  beyond  line-of-sight,  or  that  have  demonstrated  reliability 
making  FTS  undesirable  or  unnecessary  but  for  which  some  positive  control  was  still  warranted. 
Over  60  terrestrial  and  space-based  systems  were  analyzed.  The  terrestrial  systems  failed  to 
meet  the  minimum  requirements  set  forth  by  the  RCC  RSG.  Space-based  systems  (e.g., 
satellites)  presented  the  best  options,  but  most  were  eliminated  from  consideration  for  many  of 
the  same  reasons  as  the  terrestrial  systems.  The  alternative  that  met  the  highest  number  of  the 
RS-39  task  requirements  was  the  IRIDIUM  satellite  network.  A  working  prototype  of  the 
system  was  developed  and  demonstrated.  Although  considered  successful,  the  prototype  system 
uncovered  issues  that  require  further  study  and  must  be  corrected  before  an  operational 
implementation  is  possible.  A  full  technology  report  is  available  at  the  AFFTC.  You  can  reach 
the  point  of  contact  listed  at  the  Preface  in  the  front  of  this  document. 
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